GHSA-7q44-r25x-wm4q
HIGHRemote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows
Blast Radius
phpmailer/phpmailerReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
PHPMailer 6.4.1 contains a possible remote code execution vulnerability through the $lang_path parameter of the setLanguage() method. If the $lang_path parameter is passed unfiltered from user input, it can be set to a UNC path, and if an attacker is also able to create a remote mount on the server that the UNC path points to, a script file under their control may be executed.
Impact
Arbitrary code may be run by a remote attacker under the web server or PHP process running on Window hosts.
Patches
Mitigated in PHPMailer 6.5.0 by no longer treating translation files as PHP code, but by parsing their text content directly. This approach avoids the possibility of executing unknown code while retaining backward compatibility. This isn't ideal, so the current translation format is deprecated and will be replaced in the next major release.
Workarounds
Any of:
- Ensure that calling code does not pass unfiltered user-supplied data to the
$lang_pathparameter of thesetLanguage()method. - Block or filter the use of unknown UNC paths in this parameter (or altogether).
- Ensure that unauthorised users do not have the ability to read from unknown remote servers via UNC paths.
- Run on an OS that does not support UNC paths
References
Reported by listensec.com via Tidelift.
For more information
If you have any questions or comments about this advisory:
- Open an issue in PHPMailer
- Email the maintainers
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | phpmailer/phpmailer | all versions | 6.5.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for phpmailer/phpmailer. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update phpmailer/phpmailer to 6.5.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-7q44-r25x-wm4q is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-7q44-r25x-wm4q is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-7q44-r25x-wm4q. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-7q44-r25x-wm4q in your dependencies?
O3 detects GHSA-7q44-r25x-wm4q across Packagist dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.